{"id":"CVE-2024-11736","aliases":["EUVD-2025-0025","GHSA-f4v7-3mww-9gc2"],"status":"published","title":"Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables","description":"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00755,"percentile":0.55572,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-526"],"published":"2025-01-13T16:58:08Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-server","fixed_in":["26.0.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-quarkus-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.8"}]}],"versions":["12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","13.0.0","13.0.1","14.0.0","15.0.0","15.0.1","15.0.2","15.1.0","15.1.1","16.0.0","16.1.0","16.1.1","17.0.0","17.0.1","18.0.0","18.0.1","18.0.2","19.0.0","19.0.1","19.0.2","19.0.3","20.0.0","20.0.1","20.0.2","20.0.3","20.0.4","20.0.5","21.0.0","21.0.1","21.0.2","21.1.0","21.1.1","21.1.2","22.0.0","22.0.1","22.0.2","22.0.3","22.0.4","22.0.5","23.0.0","23.0.1","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","24.0.0","24.0.1","24.0.2","24.0.3","24.0.4","24.0.5","25.0.0","25.0.1","25.0.2","25.0.3","25.0.4","25.0.5","25.0.6","26.0.0","26.0.1","26.0.2","26.0.4","26.0.5","26.0.6","26.0.7"]}],"products":[{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of keycloak 26.0"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"rhbk 26.0.8"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:0299","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0300","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11736","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2328850","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-f4v7-3mww-9gc2","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/7a76858fe4aa39a39fb6b86dd3d2c113d9c59854","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11736","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f4v7-3mww-9gc2"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11736.json","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-11736","title":"Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables","description":"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.","status":"published","published":"2025-01-14T08:36:08.583Z","modified":"2026-08-31T00:27:57.051Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-526"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2025-0025","description":"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.","status":"published","published":"2025-01-14T08:36:08Z","modified":"2026-08-31T00:27:57Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:21.466916Z"}],"ghsa":[{"id":"GHSA-f4v7-3mww-9gc2","title":"Keycloak allows unrestricted admin use of system and environment variables","description":"A security vulnerability has been identified that allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. Specifically, when configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.\n\n","status":"published","published":"2025-01-13T16:58:08Z","modified":"2025-01-14T16:38:42Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-526"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2024-11736","description":"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.","status":"published","published":"2025-01-14T09:15:20.75Z","modified":"2026-08-31T01:16:44.257Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-526"],"updated_at":"2026-11-02T14:10:42.329342Z"}],"osv":[{"id":"CVE-2024-11736","title":"Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables","description":"A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.","status":"published","published":"2025-01-14T08:36:08.583Z","modified":"2026-10-28T02:31:04.482490994Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-526"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"GHSA-f4v7-3mww-9gc2","title":"Keycloak allows unrestricted admin use of system and environment variables","description":"A security vulnerability has been identified that allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. Specifically, when configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.\n\n","status":"published","published":"2025-01-13T16:58:08Z","modified":"2026-09-10T03:50:21.922687287Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-526"],"updated_at":"2026-11-02T15:46:46.006631Z"}]}}